Overview
overview
3Static
static
11/top.asp
windows7-x64
31/top.asp
windows10-2004-x64
31/新云软件.url
windows7-x64
11/新云软件.url
windows10-2004-x64
1Admin_Login.asp
windows7-x64
3Admin_Login.asp
windows10-2004-x64
3HTML.vbs
windows7-x64
1HTML.vbs
windows10-2004-x64
1Inc/check.vbs
windows7-x64
1Inc/check.vbs
windows10-2004-x64
1Inc/checkcode.vbs
windows7-x64
1Inc/checkcode.vbs
windows10-2004-x64
1Inc/clsThief.vbs
windows7-x64
1Inc/clsThief.vbs
windows10-2004-x64
1Inc/config.asp
windows7-x64
3Inc/config.asp
windows10-2004-x64
3Inc/conn.vbs
windows7-x64
1Inc/conn.vbs
windows10-2004-x64
1Inc/md5.vbs
windows7-x64
1Inc/md5.vbs
windows10-2004-x64
1Jz.vbs
windows7-x64
1Jz.vbs
windows10-2004-x64
1Jz_Add.vbs
windows7-x64
1Jz_Add.vbs
windows10-2004-x64
1Jz_Display.vbs
windows7-x64
1Jz_Display.vbs
windows10-2004-x64
1Jz_Index.vbs
windows7-x64
1Jz_Index.vbs
windows10-2004-x64
1Jz_List.vbs
windows7-x64
1Jz_List.vbs
windows10-2004-x64
1Jz_save.vbs
windows7-x64
1Jz_save.vbs
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
1/top.asp
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
1/top.asp
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
1/新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
1/新云软件.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Admin_Login.asp
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Admin_Login.asp
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
HTML.vbs
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
HTML.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Inc/check.vbs
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Inc/check.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Inc/checkcode.vbs
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
Inc/checkcode.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Inc/clsThief.vbs
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Inc/clsThief.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Inc/config.asp
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
Inc/config.asp
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Inc/conn.vbs
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Inc/conn.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Inc/md5.vbs
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Inc/md5.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Jz.vbs
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
Jz.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Jz_Add.vbs
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
Jz_Add.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Jz_Display.vbs
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Jz_Display.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Jz_Index.vbs
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Jz_Index.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Jz_List.vbs
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Jz_List.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Jz_save.vbs
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
Jz_save.vbs
Resource
win10v2004-20240802-en
General
-
Target
850fcc96f7e0aeb6486f769355289ef7_JaffaCakes118
-
Size
531KB
-
MD5
850fcc96f7e0aeb6486f769355289ef7
-
SHA1
5e350c31fd3d64560c641155899b5d1ebdc1971f
-
SHA256
e90243eca00859f5689d00e22724fa88edd78bca740e1de308a58382fcb61195
-
SHA512
706c60b0ec54040a540256d870f378ee60d091a1baeba7fa44584323e870083e1cdd42ebd8593188292ea8ba5321ac87bae503aa6b950315ec24be41f2871b14
-
SSDEEP
12288:HPJKhWBhGGux37Ka5RaUGnrpFy/c4XOsnA7Y6k+E23Oz:HBK0hGxv5RIFSD6kck
Malware Config
Signatures
Files
-
850fcc96f7e0aeb6486f769355289ef7_JaffaCakes118.rar
-
1/top.asp
-
1/新云软件.url.url
-
Admin_Login.asp.asp .vbs polyglot
-
HTML.asp.vbs
-
Inc/check.asp.vbs
-
Inc/checkcode.asp.vbs
-
Inc/clsThief.asp.vbs
-
Inc/config.asp
-
Inc/conn.asp.vbs
-
Inc/md5.asp.vbs
-
Jz.asp.vbs
-
Jz_Add.asp.vbs
-
Jz_Display.asp.vbs
-
Jz_Index.asp.vbs
-
Jz_List.asp.vbs
-
Jz_save.asp.vbs
-
News.asp.vbs
-
News_display.asp.vbs
-
SqlIn.Asp.vbs
-
ad.asp.html
-
add.asp.vbs
-
admin_Admin.asp.vbs
-
admin_Config.asp.vbs
-
admin_ConfigSave.asp.vbs
-
admin_CreateHTML.asp.vbs
-
admin_Db.asp.vbs
-
admin_Jz_Display.asp.vbs
-
admin_Jz_del.asp.vbs
-
admin_Jz_edit.asp.vbs
-
admin_Jz_list.asp.vbs
-
admin_Jz_save.asp.vbs
-
admin_Jz_top.asp.vbs
-
admin_Jz_top_l.asp.vbs
-
admin_Jz_top_s.asp.vbs
-
admin_Jz_ulock_l.asp.vbs
-
admin_Jz_ulock_s.asp.vbs
-
admin_News.asp.vbs
-
admin_News_add.asp.vbs
-
admin_News_edit.asp.vbs
-
admin_News_save.asp.vbs
-
admin_News_top.asp.vbs
-
admin_Sql.asp.vbs
-
admin_about.asp.vbs
-
admin_ad.asp.vbs
-
admin_caiji.asp.vbs
-
admin_caiji1.asp.vbs
-
admin_caiji2.asp.vbs
-
admin_caiji3.asp.vbs
-
admin_del.asp.vbs
-
admin_display.asp.vbs
-
admin_edit.asp.vbs
-
admin_jz_squ.asp.html
-
admin_link.asp.vbs
-
admin_list.asp.vbs
-
admin_main.asp.vbs
-
admin_menu.asp.vbs
-
admin_save.asp.vbs
-
admin_top.asp.vbs
-
admin_top_l.asp.vbs
-
admin_top_s.asp.vbs
-
admin_type.asp.vbs
-
admin_type_edit.asp.vbs
-
admin_ulock.asp.vbs
-
admin_ulock_s.asp.vbs
-
admin_ver.asp.vbs
-
admin_ver_edit.asp.vbs
-
asp.asp.vbs
-
chao.files/01.gif.gif
-
chao.files/05_1.gif
-
chao.files/2007-new.gif.gif
-
chao.files/button_444.gif.gif
-
chao.files/css.css
-
chao.files/hoho.gif.gif
-
chao.files/home.gif.gif
-
chao.files/index_1.gif.gif
-
chao.files/index_17.gif.gif
-
chao.files/index_19.gif.gif
-
chao.files/index_21.gif.gif
-
chao.files/index_24.gif.gif
-
chao.files/index_3.gif.gif
-
chao.files/index_34.gif.gif
-
chao.files/index_36.gif.gif
-
chao.files/index_37.gif.gif
-
chao.files/index_910.gif.gif
-
chao.files/index_912.gif.gif
-
chao.files/index_914.gif.gif
-
chao.files/mygame.gif.gif
-
chao.files/sc.gif.gif
-
chao.files/stat.htm.js
-
chao.files/stat.js.js
-
chao.files/wenzhangindex_11.gif.gif
-
chao.files/wenzhangindex_14.gif.gif
-
chao.files/wenzhangindex_16.gif.gif
-
chao.htm.html
-
chao2.files/01.gif.gif
-
chao2.files/2007-new.gif.gif
-
chao2.files/button_444.gif.gif
-
chao2.files/copyURL.gif.gif
-
chao2.files/css.css
-
chao2.files/hoho.gif.gif
-
chao2.files/home.gif.gif
-
chao2.files/index_1.gif.gif
-
chao2.files/index_17.gif.gif
-
chao2.files/index_19.gif.gif
-
chao2.files/index_21.gif.gif
-
chao2.files/index_24.gif.gif
-
chao2.files/index_3.gif.gif
-
chao2.files/index_34.gif.gif
-
chao2.files/index_36.gif.gif
-
chao2.files/index_37.gif.gif
-
chao2.files/index_910.gif.gif
-
chao2.files/index_912.gif.gif
-
chao2.files/index_914.gif.gif
-
chao2.files/mygame.gif.gif
-
chao2.files/sc.gif.gif
-
chao2.files/stat.htm.js
-
chao2.files/stat.js.js
-
chao2.files/wenzhangindex_11.gif.gif
-
chao2.files/wenzhangindex_14.gif.gif
-
chao2.files/wenzhangindex_16.gif.gif
-
chao2.htm.html .js polyglot
-
check.asp.vbs
-
click2.asp
-
code.asp.vbs
-
config.asp
-
conn.asp.vbs
-
data/22495321.mdb
-
data/kaolaji521.mdb
-
display.asp.vbs
-
foot.asp
-
gg.asp.vbs
-
go.htm.html .js polyglot
-
hao119.swf
-
image/Admin_Login1.gif.gif
-
image/Admin_Login2.gif.gif
-
image/Admin_Login3.gif
-
image/Head.Fix
-
image/Toolbar_bg.gif.gif
-
image/ad_none.psd
-
image/admin_bg.gif
-
image/admin_bg_1.gif.gif
-
image/bbk.gif.gif
-
image/bbk_main.gif.gif
-
image/bg#.gif.gif
-
image/bg.gif
-
image/bg.jpg.jpg
-
image/bg2.jpg.jpg
-
image/body1.fix
-
image/body10.fix
-
image/body11.fix
-
image/body12.fix
-
image/body13.fix
-
image/body14.fix
-
image/body15.fix
-
image/body16.fix
-
image/body17.fix
-
image/body18.fix
-
image/body2.fix
-
image/body3.fix
-
image/body4.fix
-
image/body5.fix
-
image/body6.fix
-
image/body7.fix
-
image/body8.fix
-
image/body9.fix
-
image/cha.gif.gif
-
image/css.css
-
image/css.css.bak
-
image/error.gif.gif
-
image/gt.gif.gif
-
image/ib1.gif.gif
-
image/ib2.gif.gif
-
image/ib3.gif.gif
-
image/important.gif.gif
-
image/jing.gif.gif
-
image/lt.gif.gif
-
image/position.gif
-
image/qq.gif.gif
-
image/sfdaq.gif.gif
-
image/style.asp.vbs
-
image/style.css
-
image/th_bg.gif.gif
-
image/th_img.gif.gif
-
image/toobar.gif.gif
-
image/ubb/Ubb_BOLD.GIF.gif
-
image/ubb/Ubb_Fly.gif.gif
-
image/ubb/Ubb_IMAGE.GIF.gif
-
image/ubb/Ubb_Move.gif.gif
-
image/ubb/Ubb_QUOTE.GIF.gif
-
image/ubb/Ubb_italicize.gif.gif
-
image/ubb/Ubb_swf.gif.gif
-
image/ubb/Ubb_underline.gif.gif
-
images/count.htm.js
-
images/dd.gif.gif
-
images/feiniao1.swf
-
images/gt.gif.gif
-
images/hz.gif.gif
-
images/hz1.gif.gif
-
images/jing.gif.gif
-
images/lev5.gif.gif
-
images/lz.gif.gif
-
images/lz1.gif.gif
-
images/mrtj.gif.gif
-
images/new.gif.gif
-
images/news_line.gif.gif
-
images/p1.gif.gif
-
images/spacer.gif.gif
-
images/style.css
-
images/style1.css
-
images/tj.gif.gif
-
images/tj.js.js
-
images/top.swf
-
images/zs.gif.gif
-
images/zs1.gif.gif
-
images/ztop.gif.gif
-
index.asp.vbs
-
index2_09.jpg.jpg
-
link.asp.vbs
-
links.asp.vbs
-
map.asp.vbs
-
map/sitemap.asp.vbs
-
mb/chao2.files/01.gif.gif
-
mb/chao2.files/2007-new.gif.gif
-
mb/chao2.files/button_444.gif.gif
-
mb/chao2.files/copyURL.gif.gif
-
mb/chao2.files/css.css
-
mb/chao2.files/hoho.gif.gif
-
mb/chao2.files/home.gif.gif
-
mb/chao2.files/index_1.gif.gif
-
mb/chao2.files/index_17.gif.gif
-
mb/chao2.files/index_19.gif.gif
-
mb/chao2.files/index_21.gif.gif
-
mb/chao2.files/index_24.gif.gif
-
mb/chao2.files/index_3.gif.gif
-
mb/chao2.files/index_34.gif.gif
-
mb/chao2.files/index_36.gif.gif
-
mb/chao2.files/index_37.gif.gif
-
mb/chao2.files/index_910.gif.gif
-
mb/chao2.files/index_912.gif.gif
-
mb/chao2.files/index_914.gif.gif
-
mb/chao2.files/mygame.gif.gif
-
mb/chao2.files/sc.gif.gif
-
mb/chao2.files/stat.htm.js
-
mb/chao2.files/stat.js.js
-
mb/chao2.files/wenzhangindex_11.gif.gif
-
mb/chao2.files/wenzhangindex_14.gif.gif
-
mb/chao2.files/wenzhangindex_16.gif.gif
-
mb/chao2.htm.html .js polyglot
-
mb/sf.htm.html
-
nuo.asp.asp .vbs polyglot
-
save.asp.vbs
-
search.asp.vbs
-
sf.asp.vbs
-
sf/chao2.files/01.gif.gif
-
sf/chao2.files/2007-new.gif.gif
-
sf/chao2.files/button_444.gif.gif
-
sf/chao2.files/copyURL.gif.gif
-
sf/chao2.files/css.css
-
sf/chao2.files/hoho.gif.gif
-
sf/chao2.files/home.gif.gif
-
sf/chao2.files/index_1.gif.gif
-
sf/chao2.files/index_17.gif.gif
-
sf/chao2.files/index_19.gif.gif
-
sf/chao2.files/index_21.gif.gif
-
sf/chao2.files/index_24.gif.gif
-
sf/chao2.files/index_3.gif.gif
-
sf/chao2.files/index_34.gif.gif
-
sf/chao2.files/index_36.gif.gif
-
sf/chao2.files/index_37.gif.gif
-
sf/chao2.files/index_910.gif.gif
-
sf/chao2.files/index_912.gif.gif
-
sf/chao2.files/index_914.gif.gif
-
sf/chao2.files/mygame.gif.gif
-
sf/chao2.files/sc.gif.gif
-
sf/chao2.files/stat.htm.js
-
sf/chao2.files/stat.js.js
-
sf/chao2.files/wenzhangindex_11.gif.gif
-
sf/chao2.files/wenzhangindex_14.gif.gif
-
sf/chao2.files/wenzhangindex_16.gif.gif
-
sf/chao2.htm.html .js polyglot
-
sfadd.asp.vbs
-
sitemap.asp.vbs
-
sitemap.xml.xml
-
top.asp.html .vbs polyglot
-
top.swf
-
top3.asp
-
wg.asp.vbs
-
使用说明.txt